Havex Malware

[Tuomo]

Hi all,

Do you have any information about PAN detection capability for the Havex malware family: http://www.f-secure.com/weblog/archives/00002718.html

Threat vault seems to produce no hits at the moment.

Tuomo

[ITInfraNL]

I would like more information on this too.

Nick

[pulukas]

This is not showing up yet in the threat vault as an existing update for PA.

https://threatvault.paloaltonetworks.com/

You can open a ticket with support to get a more specific update.

[PANUser-1234]

Did you got some more information about havex/oldrea malware coverage in the threat signatures unitl now?

Andy

[LCMember2327]

Any update from PA?

[Dulle]

While we wait for Palo Alto to wake up; please have a look at these:

http://www.symantec.com/connect/blogs/dragonfly-western-energy-companies-under-sabotage-threat

http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/Dragonfly_Threa...

-=Tommy=-

[pulukas]

If this is a critical vulnerability to you, I would open a ticket. This will get the signature escalated internally.

You can't expect an official update from PA here.  These are just user to user support forums.  We are lucky that many PA employees spend a great deal of time here.  But official support is still via tickets to the support portal.

[Dulle]

But we have.....

[ericgearhart]

Looks like Havex made it into the ThreatVault:

https://threatvault.paloaltonetworks.com/Home/VirusDetail/2889719

[ericgearhart]

Interestingly enough if you click on the hash links, PA's own WildFire flags it as benign! Hmph. :smileyplain: